When should I use consent as the lawful basis for processing?

Consent is appropriate when you want to give the individual genuine choice and control over how their data is used. It is commonly used for marketing communications, event photography, research participation, and processing special category data. However, consent may not be the best basis if there is a power imbalance (e.g. employer-employee), as the ICO considers that consent may not be freely given in such relationships.

What makes GDPR consent valid?

Valid consent must be: freely given (no pressure or detriment for refusing), specific (for a particular purpose), informed (the individual understands what they are consenting to), unambiguous (given by a clear affirmative action such as ticking a box or signing a form), and demonstrable (you must be able to prove the individual consented). Pre-ticked boxes, silence, and inactivity are not valid consent.

Can I bundle consent with terms and conditions?

No. Article 7(2) of the UK GDPR requires that consent requests must be clearly distinguishable from other matters. You should not bury consent requests within lengthy terms and conditions. Consent should be presented separately and prominently, with a clear explanation of what the individual is consenting to.

How can someone withdraw their consent?

The UK GDPR (Article 7(3)) requires that withdrawing consent must be as easy as giving it. Common withdrawal methods include clicking an unsubscribe link in emails, sending an email to the data controller, using an online preference centre, or writing to the organisation. You must process withdrawal requests promptly.

What happens if consent is withdrawn?

You must stop processing the individual's data for the consented purpose without undue delay. However, any processing that took place before the withdrawal remains lawful — withdrawal is not retrospective. If you have another lawful basis for processing the data (such as a legal obligation), you may continue to process it for that separate purpose.

Do I need explicit consent for special category data?

Yes. Processing special category data (health data, biometric data, racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic data, and data concerning sex life or sexual orientation) generally requires explicit consent under Article 9(2)(a) of the UK GDPR. 'Explicit' means the consent must be expressly confirmed in words, not inferred from conduct.

Free GDPR Consent Form Template

A GDPR consent form is a document used to obtain an individual's explicit, informed consent for the processing of their personal data.

FreePDF & Word

Your data stays on your device — nothing is sent to any server.

organisation

Organisation Name*

Organisation Address*

Organisation Contact Email*

subject

Data Subject's Full Name*

consent

Purpose of Data Processing*

Describe clearly and specifically what the data will be used for.

Types of Personal Data to be Processed*

Data Retention Period*

How to Withdraw Consent*

execution

Date*

Document Preview

CONSENT FORM for the processing of personal data pursuant to Article 6(1)(a) and Article 7 of the UK General Data Protection Regulation DATA CONTROLLER: [organisationName] [organisationAddress] Email: [organisationEmail] DATA SUBJECT: [dataSubjectName] 1. PURPOSE OF PROCESSING [organisationName] would like to process your personal data for the following purpose(s): [processingPurpose] 2. PERSONAL DATA TO BE PROCESSED The following categories of personal data will be collected and processed: [dataTypes] 3. RETENTION PERIOD Your personal data will be retained for: [retentionPeriod] After the retention period expires, your data will be securely deleted unless you have renewed your consent or another lawful basis for processing applies. 4. YOUR RIGHTS Under the UK GDPR, you have the following rights: (a) Right of access — to request a copy of your personal data; (b) Right to rectification — to request correction of inaccurate data; (c) Right to erasure — to request deletion of your data; (d) Right to restrict processing — to limit how your data is used; (e) Right to data portability — to request your data in a portable format; (f) Right to object — to object to the processing of your data; (g) Right to withdraw consent — you can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. 5. HOW TO WITHDRAW CONSENT [withdrawalMethod] Withdrawing your consent will not affect the lawfulness of any processing carried out before the withdrawal. 6. COMPLAINTS If you are unhappy with how your data is being handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: www.ico.org.uk 7. CONSENT I, [dataSubjectName], confirm that: [ ] I have read and understood the information provided above. [ ] I freely give my consent for [organisationName] to process my personal data for the purpose(s) described above. [ ] I understand that I can withdraw my consent at any time. Signature: ___________________________ Name: [dataSubjectName] Date: [date]

Important Notes

Legal Disclaimer

Consent under the UK GDPR must meet the requirements of Articles 4(11) and 7. Article 4(11) defines consent as 'any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her'. Article 7(1) requires controllers to be able to demonstrate that the data subject has consented. Article 7(2) provides that consent requests must be clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language. Article 7(3) gives data subjects the right to withdraw consent at any time, and withdrawal must be as easy as giving consent. Recital 42 clarifies that consent is not freely given if there is a clear imbalance between the data subject and the controller. The ICO's guidance on consent (available at ico.org.uk) provides detailed practical guidance on meeting these requirements.

This template is provided for informational purposes only and does not constitute legal advice. For complex legal matters, we recommend consulting a qualified solicitor.

Free GDPR Consent Form Template

Important Notes

Frequently Asked Questions

Related Templates